Hi Everyone,  First time using Splunk Community. I have been working with Splunk for about a year and I've been doing okay but I'm trying to use Active Directory logs to identify when accounts are created. I was looking for ways to do this. I tried using userAccountControl or pwdLastSet=0 but what I thought was a sure thing was to use uSNCreated=uSNChanged. But when I add that to the search, I get no result even though I can see that the original creation record has the same value for both.    Any suggestions are greatly appreciated. Thank you! ... View more